The Administrative Simplification provisions of the Health Insurance Portability and Accountability Act (HIPAA) require the Department of Health and Human Services (HHS) to establish national standards for electronic healthcare transactions and national identifiers for providers, health plans, and employers. They also require that the HHS adopt regulations to protect the privacy and security of healthcare information. These standards are intended to improve the efficiency and effectiveness of the nation's healthcare system by encouraging the widespread use of electronic data interchange in health care.

In January 2013, the HHS released final regulations that, according to the HHS, represented “the most sweeping changes to the HIPAA Privacy and Security Rules since they were first implemented.” The regulations reflected changes brought about by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 and the Genetic Information Nondiscrimination Act of 2008 (GINA).

Group health plans with fewer than 50 participants that are administered solely by the employer are exempt from the HIPAA privacy, electronic transaction, and security standards (45 CFR 160.103).

The HIPAA Privacy Rule creates national standards to protect individuals' medical records and other personal health information and to give patients more control over their health information. It sets limits on the use and release of health records. It provides for safeguards that covered entities (healthcare providers, health plans, and healthcare clearinghouses) and their business associates must implement to protect the privacy of health information.

The Privacy Rule provides that, in general, a covered entity may not use or disclose an individual's protected health information (PHI) without specific authorization, except as permitted or required by the Privacy Rule (45 CFR 164.502). These include uses and disclosures made for routine “treatment, payment, and healthcare operations” (TPO) purposes.

If a use or disclosure is permitted or required, covered entities and business associates must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request (45 CFR 164.502(b)).

The Privacy Rule requires many healthcare plans to do the following:

Important: Health plans may disclose PHI to plan sponsors only for plan administrative purposes and only if the sponsor certifies that it will use the information in accordance with the standards. Plan documents must be amended to provide that disclosure will be limited to permitted uses (45 CFR 164.504).

Warning: A plan may never disclose PHI to the plan sponsor for the purpose of employment-related actions or decisions, or in connection with any other benefit or employee benefit plan of the plan sponsor.

The HIPAA Privacy Rule sets out numerous specific policies, procedures, documents, and personnel appointments that a covered entity must implement in order to comply. In addition, the rule sets out several ways that a group health plan can reduce its compliance burden.

Privacy notice. The HIPAA Privacy Rule requires that group health plan participants be provided with adequate notice of the uses and disclosures of their PHI that may be made by a covered entity and of their privacy rights and the plan's legal duties with respect to PHI (45 CFR 164.520). Generally, a group health plan that provides health benefits solely through an insurance contract with a health insurance issuer or a health maintenance organization (HMO) does not have to provide a notice. However, if such a plan receives more than summary health information and/or enrollment information from the insurer, it must have a notice prepared that must be provided upon request to any person who has a right to a notice. A self-insured group health plan must distribute the notice itself.

Privacy notice availability reminders. The HIPAA privacy regulations require group health plans to notify plan participants at least once every 3 years of the availability of the privacy notice and how to obtain it.

Note: The regulations require covered entities to describe certain uses and disclosures of PHI, detail when separate statements for certain uses or disclosures are required, state that they are required to notify affected individuals following a breach of unsecured PHI, and describe the procedure that a health plan must follow if there is a material change to the notice.

Administrative requirements. The Privacy Rule imposes certain administrative requirements on covered entities (45 CFR 164.530). However, the requirements are designed to be flexible to allow a covered entity to evaluate its own needs and implement solutions that are appropriate for its particular organization. The administrative requirements address:

A group health plan is exempt from several compliance requirements if it provides health benefits solely through an insurance contract with a health insurance issuer or an HMO, and the only PHI it receives or creates is either summary health information or enrollment information. However, such an exempt plan does have to refrain from intimidating and retaliatory acts, may not require a waiver of rights, and must comply with the documentation requirements.

A group health plan generally does not have to be amended before it is permitted to share information with the plan sponsor if it or its health insurance issuer or HMO discloses only limited information to the plan sponsor (45 CFR 164.504). The information that may be provided without activating the amendment requirement falls into two categories.

The first is summary health information that the plan sponsor requests for the limited purposes of:

The second category is information on whether an individual is participating in the group health plan or is enrolled in or has disenrolled from a health insurance issuer or HMO offered by the plan.

Only information that is created, maintained, or transmitted by a covered entity is PHI. HIPAA’s privacy rules do not apply to employers or to the employment functions of covered entities when they are acting in their role as employers. PHI does not include employment records held by a covered entity, such as a physician’s office, hospital, group health plan or insurance company, in its capacity as an employer.

An employer generally holds health information for employment-related purposes, such as administering sick leave and complying with laws such as the Family and Medical Leave Act (FMLA), the Americans with Disabilities Act (ADA), workers’ compensation, and federal and state health and safety regulations.

This type of health information, held by the employer as an employer, is not PHI. On the other hand, if employees of a covered entity seek treatment or reimbursement from their employer (as a healthcare provider or health plan), their treatment and reimbursement records are PHI.

The privacy rules do not explicitly define certain types of individually identifiable health information held by an employer as “employment records” excluded from the definition of PHI. Instead, HHS indicated that the capacity in which the information is held determines whether it is PHI. If an employer creates, receives, or maintains it in an employer’s capacity, it is not PHI. If an employer creates, receives, or maintains it in the capacity of a covered entity (such as a health plan), it is PHI.

Vaccine status. HIPAA does not “prohibit an employer from requiring a workforce member to disclose whether they have received a COVID-19 vaccine to the employer, clients, or other parties,” according to a question-and-answer document from HHS’s Office for Civil Rights (OCR).

Because HIPAA does not cover employment records, “the Privacy Rule does not regulate what information can be requested from employees as part of the terms and conditions of employment that an employer may impose on its workforce,” the OCR explained.

HIPAA still must be considered when an employer tries to obtain employee vaccine information from a covered entity like a physician or other healthcare provider, or the employer’s own group health plan or insurer. This data would be considered PHI in a covered entity’s hands, and thus subject to the usual HIPAA requirements.

The HIPAA Privacy Rule also gives individuals certain rights regarding their own PHI. A plan sponsor must agree to help the group health plan or insurer satisfy these rights as a condition of obtaining PHI.

Access. An individual has the right to see and copy his or her own PHI that a covered entity holds in a “designated record set” (45 CFR 164.524). A designated record set includes, in the health plan context, enrollment, payment, and claims adjudication systems.

Covered entities can require access requests to be made in writing. Access need not be granted to psychotherapy notes or to information compiled for litigation. The covered entity must respond to an access request within 30 days after receiving it and provide the PHI in whatever form the individual requests, if feasible.

Under the 2013 final HITECH rules, PHI maintained in an electronic designated record set must be provided in the electronic form and format requested, if “readily producible.” These rules also added a requirement to transmit PHI directly to a third party, if designated by the requester clearly and in writing. A court later ruled that this third-party transmission right applies only to PHI in an electronic health record (EHR) (Ciox Health, LLC v. Azar, 435 F. Supp. 3d 30 (D.D.C., Jan. 23, 2020)).

Reasonable, cost-based fees may be charged for access. The 2013 rules detail the costs that may and may not be recouped by access fees. Denials of PHI access may be subject to an appeals process, depending on the rationale.

Detailed guidance on access rights is available on the OCR website.

Accounting of disclosures. The Privacy Rule provides individuals with the right to receive an accounting of certain disclosures of the individual's PHI made by a covered entity in the 6 years before the request for the accounting (45 CFR 164.528). This requirement does not apply to disclosures made for TPO purposes.

The HITECH Act included a new requirement to account for TPO disclosures from an EHR. However, implementing rules that the HHS proposed in 2011 were so unpopular that the agency decided to withdraw the proposal and start over.

Amendment. An individual may request amendment of his or her PHI that a covered entity holds in a designated record set (45 CFR 164.526). The covered entity may deny the request if it follows certain procedures.

Right to restrict. Individuals may request restrictions on using and disclosing their PHI beyond the protections already afforded by HIPAA (45 CFR 164.522). Covered entities are not required to grant these requests, except that under the HITECH Act, a healthcare provider must grant a request to restrict disclosure to a health plan if the patient pays in full.

The HIPAA Security Rule is a corollary to the Privacy Rule and specifies a series of administrative, technical, and physical security procedures for covered entities and business associates to use to ensure the confidentiality, integrity, and availability of PHI in electronic format. The standards require covered entities and business associates to implement basic safeguards to protect electronic PHI from unauthorized access, alteration, deletion, and transmission (45 CFR 164.306). The security standards do not require use of specific technologies and were designed to be “technology neutral” in order to facilitate using the latest and most promising technologies that meet the needs of different healthcare organizations.

The various standards may have either “required” or “addressable” implementation specifications. If an implementation specification is described as “required,” the specification must be implemented. The concept of “addressable implementation specifications” was developed to provide covered entities and business associates with additional flexibility in complying with the security standards. A covered entity or business associate will have to decide whether a given addressable implementation specification is a reasonable and appropriate security measure to apply within its particular security framework. This decision will depend on a variety of factors, such as the entity's risk analysis, risk mitigation strategy, security measures already in place, and the cost of implementation. The decisions that a covered entity or business associate makes regarding addressable specifications must be documented.

Covered entities and business associates have some flexibility in designing the security measures they will implement, but they cannot assume that those measures will always remain “reasonable and appropriate.” Thus, covered entities and business associates are required to periodically review their security measures and modify them when necessary.

There are quite a few administrative safeguards that covered entities and business associates are required to implement (45 CFR 164.308). More specifically, they are required to:

Covered entities and business associates are also required to implement certain physical safeguards (45 CFR 164.310). They are required to:

Finally, covered entities and business associates are required to implement various technical safeguards (45 CFR 164.312). They must:

Requirements for group health plans. Unless a plan discloses only limited electronic PHI to the plan sponsor, the plan documents must be amended to provide that the plan sponsor will reasonably and appropriately safeguard electronic PHI created, received, maintained, or transmitted to or by the plan sponsor on behalf of the group health plan (45 CFR 164.314).

Many of HIPAA’s requirements apply to covered entities and their “business associates.” Generally, a business associate is any person or entity that performs some function for a covered entity that involves handling PHI. The formal definition includes any person or entity that:

Additionally, a business associate would include any “subcontractor that creates, receives, maintains, or transmits [PHI] on behalf of the business associate.” This provision greatly expands the group of organizations that covered entities and their direct business associates must ensure are contractually obligated to comply with the Privacy Rule and Security Rule.

Business associate contracts. Under the Privacy Rule, a covered entity must enter into written agreements with business associates (often referred to as “business associate agreements”) that contain certain terms. For example, the business agreement must:

Additionally, HIPAA regulations require that business associate contracts must provide that the business associate will:

These contract requirements also apply to the contract or other arrangement between a business associate and a subcontractor.

Direct application of the privacy and security rules to business associates. Under the HITECH Act, the security rules and many of the privacy rules apply directly to business associates in the same way that they apply to covered entities, including the civil and criminal penalties for violations (42 USC 17931 and 42 USC 17934).

HIPAA was amended in 2009 to require notification by covered entities and their business associates of breaches of unsecured protected health information (UPHI) (42 USC 17932). If a covered entity discovers that UPHI that the entity accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses has been breached, the entity must notify each individual whose UPHI has been, or is reasonably believed by the entity to have been, accessed, acquired, or disclosed as a result of the breach. A business associate of a covered entity that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses UPHI must notify the covered entity if the business associate discovers such a breach of the privacy of the UPHI. The notice must identify each individual whose UPHI has been, or is reasonably believed by the business associate to have been, accessed, acquired, or disclosed during such breach.

“Breach” defined. The term “breach” means the unauthorized acquisition, access, use, or disclosure of PHI that compromises the security or privacy of such information (45 CFR 164.402).

Exceptions. A breach does not include the following:

An acquisition, access, use, or disclosure of PHI in an impermissible manner is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment of at least the following factors:

The regulations also note that UPHI means PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by HHS guidance.

Securing PHI. The HITECH Act requires the HHS to issue (and annually update) guidance specifying the technologies and methodologies that render PHI unusable, unreadable, or indecipherable to unauthorized individuals. While covered entities and business associates are not required to follow the guidance, the specified technologies and methodologies, if used, create the functional equivalent of a safe harbor and, thus, result in covered entities and business associates not being required to provide the notification otherwise required in the event of a breach. However, while adherence to this guidance may result in covered entities and business associates not being required to provide the notifications in the event of a breach, covered entities and business associates still must comply with all other federal and state statutory and regulatory obligations that may apply following a breach of PHI, such as state breach notification requirements, if applicable, as well as the obligation of covered entities to mitigate, to the extent practicable, any harmful effect that is known to the covered entity as a result of a breach of PHI by the covered entity or business associate.

Technologies and methodologies that make PHI unusable, unreadable, or indecipherable. HHS guidance provides that PHI is rendered unusable, unreadable, or indecipherable to unauthorized individuals only if one or more of the following applies:

For more information, visit http://www.hhs.gov/hipaa..

Notice requirements. A breach is to be treated as discovered by a covered entity or by a business associate as of the first day on which the breach is known by any person, other than the individual committing the breach, who is an employee, officer, or other agent of the entity or associate, or should reasonably have been known to such entity or associate to have occurred (42 USC 17932 and 45 CFR 164.404). Notifications must be made without unreasonable delay and in no case later than 60 calendar days after the discovery of a breach by the covered entity or business associate involved.

The covered entity or business associate involved will have to prove that all notifications were made as required, including evidence demonstrating the necessity of any delay.

How to provide notice. Notices to be provided to an individual, with respect to a breach, must be provided promptly and in writing by first-class mail to the individual at the last known address of the individual or, if specified as a preference by the individual, by e-mail. If the covered entity knows the individual is deceased and has the address of the next of kin or personal representative of the individual, written notification must be sent by first-class mail to either the next of kin or personal representative. The notification may be provided in one or more mailings as information becomes available.

Substitute notice. If the contact information for an individual is insufficient or out of date, substitute notice may be provided.

If there is insufficient or out-of-date contact information for fewer than 10 individuals, a substitute notice may be provided by an alternative form of written notice, telephone, or other means (45 CFR 164.404).

If there is insufficient or out-of-date contact information for 10 or more individuals, the substitute notice must be made by a conspicuous posting for a period of 90 days on the home page of the website of the covered entity or a conspicuous notice in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside. This notice must include a toll-free phone number that remains active for at least 90 days with which an individual can learn whether the individual’s unsecured PHI may be included in the breach.

Urgent notice. If the covered entity involved expects the possible imminent misuse of the UPHI, the entity, in addition to the written notice, may provide information to individuals by telephone or other appropriate means.

Media notice. Notice must be provided to prominent media outlets serving a state or jurisdiction without unreasonable delay and in no case later than 60 days after the discovery of a breach involving UPHI of more than 500 residents of the same state or jurisdiction (45 CFR Sec. 164.406). Media notification supplements, but does not replace, individual notification.

Notice to HHS. Notice must be provided to the HHS by covered entities when UPHI has been acquired or disclosed because of a privacy breach. If the breach involved 500 or more individuals, the notice must be provided immediately. If the breach involved less than 500 individuals, the covered entity may maintain a log of breaches discovered during the preceding calender year and annually submit the log to the HHS (45 CFR Sec. 164.408).

Notice content. Regardless of how the notice of a breach is provided to individuals, the notice must include, to the extent possible, the following:

Note: If a law enforcement official determines that a notification, notice, or posting required would impede a criminal investigation or cause damage to national security, the notification, notice, or posting may be delayed.

Business associates. A business associate that discovers a breach of UPHI must notify the covered entity of such breach (45 CFR 164.410). A breach is treated as discovered by a business associate as of the first day on which it is known to the business associate or, by exercising reasonable diligence, would have been known to the business associate. A business associate will be deemed to have knowledge of a breach if the breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is an employee, officer, or other agent of the business associate.

A business associate must provide the notification required without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. The notification is to include, to the extent possible, the identification of each individual whose UPHI has been, or is reasonably believed by the business associate to have been, accessed, acquired, used, or disclosed during the breach. A business associate must also provide the covered entity with any other available information that the covered entity is required to include in notification to the individual at the time of the notification or promptly thereafter as the information becomes available.

HIPAA directed the HHS to adopt national standards for certain types of electronic healthcare transactions. These include claims, payment, eligibility, and enrollment. Only HIPAA-covered entities—health plans, providers, and clearinghouses—must follow the standards, although employers may decide to agree to them by contract.

Health plans may comply by transmitting/receiving the standardized information themselves or by contracting with a healthcare clearinghouse or a business associate to do so. Plans must ensure compliance by any business associate, such as a third-party administrator, conducting these transactions on their behalf.

The National Provider Identifier (NPI) is a unique identification number for covered healthcare providers. Covered healthcare providers and all health plans and healthcare clearinghouses are required to use the NPIs in the administrative and financial transactions adopted under HIPAA. The NPI is a 10-digit number that does not carry other information about healthcare providers, such as the state in which they are located or their medical specialty. For more information, visit http://www.cms.gov.

Under the HITECH Act, the HHS is required to perform periodic audits to make sure covered entities and business associates are in compliance with HIPAA's Privacy and Security Rules and Breach Notification standards.

In 2011, the OCR developed a broad-based audit protocol and used it to perform Phase 1, a pilot program involving detailed, on-site audits of 115 covered entities. The OCR found widespread compliance problems at these organizations, especially regarding the security rules.

In 2016 and 2017, the OCR conducted Phase 2, which involved “desk audits” of 166 covered entities and 41 business associates for compliance with selected provisions. Once again, the agency found recurring shortcomings in security risk analysis and management, as well as the Privacy Rule’s right to access. For more information, including the audit protocol, visit HHS’s website at http://www.hhs/gov/hipaa.